All things related to multicast

[Yadong Wang <>]

Today, we see 139609 kbps from 131.130.50.3.  It is wrong, we have to block 
131.130.50.3.

Group: 224.2.127.254, (SAP.MCAST.NET)

  Source: 131.130.50.3 (printspare.astro.univie.ac.at)
     Rate: 45093 pps/139609 kbps(1sec), 139609 kbps(last 10 secs), 19963 
kbps(life avg)

Yadong Wang
Data Network Operations
University of Southern California

Mark Foster wrote:
> as of Mar 19, 15:20 PDT, we're seeing some pretty big rates on the MIX from
> multiple sources:
>
>  64.251.63.188   224.2.127.254     5120K
>  64.251.63.66    224.2.127.254      444K
>  132.236.117.51  224.2.127.254      509K
>  128.32.129.171  224.0.5.128        796K
>
> this seems to be causing quite a bit of flapping on some peers.
>
> -- Mark Foster
> NASA Research & Engineering Network / CSC
> NASA Ames Research Center
>
> On 3/19/2010 12:44 PM, Leonard Giuliano wrote:
>
> > Anyone notice a large rate of SAP packets the last few days?  Have seen 
> > spikes up to 20Mbps of SAP.  Here's a packet from a flow seen during one 
> > of the spikes.  Looks like the culprit is 131.252.176.85:
> >
> >
> >
> > No.     Time        Source                Destination           Protocol Info
> >       1 0.000000    131.252.176.85        224.2.127.254         SAP/SDP  
> > Announcement (v1), with session description